[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions:

For hash functions, the input is called the message , and the output is called the (message) digest or  the hash  value . The  length  of  the  message  can  vary;  the  length  of  the  digest  is  fixed. A cryptographic  hash  function  is  a  hash  function  that  is  designed  to  provide  special  properties, including collision resistance and preimage resistance, that are important for many applications in  information security. For example, a cryptographic hash function increases the security and efficiency of a digital signature scheme when the digest is digitally signed instead of the message itself. In  this  context,  the  collision  resistance  of  the  hash  function  provides  assurance  that  the original message could not have been altered to a different message with the same hash value, and  hence,  the  same  signature. Other  applications  of  cryptographic  hash  functions  include pseudorandom bit generation, message authentication codes, and key derivation functions. The KECCAKp permutations were designed to be suitable as the main components for a variety of cryptographic functions, including keyed functions for authentication and/or encryption. The six  SHA-3  functions  can  be  considered  as  modes  of  operation  (modes)  of  the  KECCAKp [1600,24] permutation. In the future, additional modes of this permutation or other KECCAKp permutations  may  be  specified  and  approved  in  FIPS  publications  or in  NIST  Special Publications. | hash value         | See digest. |
|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| HMAC               | Keyed-Hash Message Authentication Code. |
| KDF                | Key derivation function. |
| KECCAK             | The family of all sponge functions with a KECCAK- f permutation as the underlying function and multi-rate padding as the padding rule.

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide?

[Assistant]
## Risk Management Framework for Information Systems and Organizations

A System Life Cycle Approach for Security and Privacy

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. ## JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-37r2

<!-- image -->

## NIST Special Publication 800-37

Revision 2

## Risk Management Framework for Information Systems and Organizations

## A System Life Cycle Approach for Security and Privacy

## JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-37r2

## December 2018

<!-- image -->

U.S. Department of Commerce Wilbur L.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity” provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2022-09-08

## How to Cite this NIST Technical Series Publication:

Megas KN, Fagan M, Cuthill B, Hoehn B, Lemire D, Herold R (2022) Workshop Summary Report for 'Building on the NIST Foundations: Next Steps in IoT Cybersecurity'. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8431. https://doi.org/10.6028/NIST.IR.8431

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448

Michael Fagan: 0000-0002-1861-2609

Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Security and Trust Considerations for Digital Twin Technology:

- Unmanned aerial vehicles (drones): Unmanned aerial vehicles (UAVs) or drones are used in environmental monitoring. UAVs come in all sizes, shapes, configurations, and levels of sophistication. More advanced drones can operate autonomously or under the control of a human in a command-and-control center that is far from the UAV's physical location. Remote operators of UAVs have user interfaces that provide the real-time information about the UAV's state and condition.
- Ocean-going vessels: Digital twins can be used to construct 2D and 3D static views or VR/AR views of ocean vessels. VR/AR views would enable architects, designers, engineers, and maintenance crews to see the vessel as if they were physically walking through it. During operations, digital twin technology would enable operators and crew members to monitor every aspect of the ship, possibly precluding the need for certain physical monitoring and inspections.
- Oil derricks and ocean-drilling platforms: Oil derricks may drill for oil in inhospitable and potentially treacherous environments at great depths. Systems built around digital twins enable designers, engineers, and operators to form models and visual representations of oil rigs, drill rigs, and drill bit heads deep in the ocean.
- Robotic surgery: There are surgical robots that perform various kinds of surgery. Some require an actual human surgeon to control the robot, while others only require a human surgeon to monitor the robot's automatic execution of the surgery. Digital twin technology could be used in pre-surgery planning and to foster surgical tool interoperability. For example, one company's surgical robot could interoperate with another company's VR system that specializes in the representation of human organs.

Security and Trust Considerations for Digital Twin Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The NIST Special Publication (SP) 800-90 series of documents supports the generation of highquality random bits for cryptographic and non-cryptographic use. SP 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators ,  specifies several deterministic random bit generator (DRBG) mechanisms based on cryptographic algorithms. SP 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation ,  provides guidelines for the development and validation of entropy sources. This document (SP 800-90C) specifies  constructions  for  the  implementation  of  random  bit  generators  (RBGs)  that  include DRBG mechanisms as specified in SP 800-90A and that use entropy sources as specified in SP 80090B. Constructions for four classes of RBGs - namely, RBG1, RBG2, RBG3, and RBGC - are specified in this document. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to A Threat Analysis on UOCAVA Voting Systems:

| X        |          | LEAST PRIVILEGE                                         | Databases and IT systems used to manage registration information should be protected with access control mechanisms.
|
| IA-1         | X        |          | X        | IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES | Officials should develop procedures and implement technical mechanisms to identify voters, election officials and system administrators. Procedures may be used to authenticate voters, while IT systems should include IA and access control mechanisms. |
| IA-2         | X        |          | X        | USER IDENTIFICATION AND AUTHENTICATION                  | Officials should develop procedures and implement technical mechanisms to identify voters, election officials and system administrators. Procedures may be used to authenticate voters, while IT systems should include IA and access control mechanisms. |
| IA-4         | X        |          | X        | IDENTIFIERMANAGEMENT                                    | Officials should develop procedures and implement technical mechanisms to identify voters, election officials and system administrators. Procedures may be used to authenticate voters, while IT systems should include IA and access control mechanisms. |
| IA-5         | X        |          | X        | AUTHENTICATORMANAGEMENT                                 | Officials should develop procedures and implement technical mechanisms to identify voters, election officials and system administrators. Procedures may be used to authenticate voters, while IT systems should include IA and access control mechanisms. |
| IR-4         |          | X        | X        | INCIDENT HANDLING                                       | Officials should monitor for disruptions in their IT systems and in external essential systems, such as postal mail delivery.

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 4)

[Assistant]
e and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures.
It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones. ## Keywords

incident response; information security; malware

## Acknowledgments

The authors, Murugiah Souppaya of the National Institute of Standards and Technology (NIST) and Karen Scarfone of Scarfone Cybersecurity, thank their colleagues who assisted with developing this revision of the publication. ## Acknowledgments, Original Version of SP 800-83

The authors, Peter Mell of the National Institute of Standards and Technology (NIST) and Karen Kent and Joseph Nusbaum of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would particularly like to acknowledge Tim Grance and Murugiah Souppaya of NIST and Lucinda Gagliano, Thomas Goff, and Pius Uzamere of Booz Allen Hamilton for their keen and insightful assistance throughout the development of the document. The authors would also like to express their thanks to security experts Mike Danseglio (Microsoft), Kurt Dillard (Microsoft), Michael Gerdes (Getronics RedSiren Security Solutions), Peter Szor (Symantec), Miles Tracy (U.S. Federal Reserve System), and Lenny Zeltser (Gemini Systems LLC), as well as representatives from the General Accounting Office, and for their particularly valuable comments and suggestions. The National Institute of Standards and Technology would also like to express its appreciation and thanks to the Department of Homeland Security for its sponsorship and support of NIST Special Publication 80083.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-05-15

## How to Cite this NIST Technical Series Publication

Fagan M, Gilbert D (2025) Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8557. https://doi.org/10.6028/NIST.IR.8557

## Author ORCID iDs

Michael Fagan: 0000-0002-1861-2609

Dylan Gilbert: 0009-0003-6061-3757

## Contact Information

immersivetech@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8557/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This document reports on the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies (the Workshop) hosted by the Symposium in Usable Privacy and Security (SOUPS). The Workshop was held on August 7 th , 2024 before the in-person symposium held August 11 th and 12 th , 2024 in Philadelphia, Pennsylvania.

Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Mobile Forensic Reference Materials_ a Methodology and Reification:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.    ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology.   ITL's  responsibilities  include  the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.    This  Interagency  Report  discusses  ITL's  research,  guidance,  and  outreach  efforts  in computer  security,  and  its  collaborative  activities  with  industry,  government,  and  academic organizations.

The  results  from  past  and  recent  work  indicate  that  assessments  of  mobile  forensic  tools  can reveal subtle inaccuracies that exist.  While the approach discussed in this report is suited for identity modules, it is not immediately clear whether the same or a similar approach could be used to populate handsets and how that might be realized.  Figure 13 shows one possibility.  The adaption is to use agent applications that are platform dependent, coded in a suitable language, and executed directly on the handset.  Many platform families allow middleware development and support a common Application Programming Interface (API) suitable for this purpose.  The application and data could be brought to the handset through various means, such as a memory card or data transfer, and the same means used to retrieve the summary report.

Mobile Forensic Reference Materials_ a Methodology and Reification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

| Date | Type | Change | Page | |------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------| | 10/10/2019 | Substantive | Appendix F, section 3: Changed from: 'NIST SP 800-46: Guide to Enterprise Telework and Remote Access Security;' to 'NIST [SP 800-46]: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security' 'NIST SP 800-52: Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations' to 'NIST [SP 800-52]: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations;' and 'NIST SP 800-124: Guidelines on Cell Phone and PDA Security' to 'NIST [SP 800- 124]: Guidelines for Managing the Security of Mobile Devices in the Enterprise' | F-1 - F-2 | | 10/10/2019 | Substantive | Appendix F, section 4: Added 'Associated NIST [SP 800-53] Control: CM-7.' | F-2 | | 10/10/2019 | Substantive | Appendix F, section 5: Added 'Associated NIST [SP 800-53] Control: AC-17.' | F-2 | | 10/10/2019 | Substantive | Appendix F, section 5: Changed from: 'NIST SP 800-46: Guide to Enterprise Telework and Remote Access Security;' to 'NIST [SP 800-46]: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security' 'NIST SP 800-52: Guidelines for the Selection and Use of

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI:

3.2.4 POSIX 1

Conformance Document, October 1994
GTI - Supported by Product
MFS - Supported by Product

MC - Not Provided by Product
AP - Supported by Product

Computer Hardware Supplier: American Megatrends, Inc. 3.2.4 POSIX 1

Conformance Document, October 1994
GTI - Supported by Product
MFS - Supported by Product

MC - Not Provided by Product
AP - Supported by Product

Computer Hardware Supplier: Compaq Computer Corporation
Computer Hardware Product: Compaq Proliant 2000, Model 5/66
C Compiler: SCO ODT Development System Release 3. 3.2.4 POSIX 1 Conformance

Document, October 1994

GTI - Supported by Product
MFS - Supported by Product

MC - Not Provided by Product
AP - Supported by Product

Computer Hardware Supplier: Compaq Computer Corporation
Computer Hardware Product: Compaq ProLiant 2000, Model 5/90
C Compiler: SCO ODT Development System Release 3.

Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Networks of 'Things':

2 RFID is an automatic identification method that stores and remotely retrieves data via a RFID tag or transponder. A RFID programmer encodes information onto a tiny microchip within a thin RFID inlay. In supply chain applications, these inlays typically are embedded in a tag that looks similar to pressure sensitive labels. RFID inlays can be applied to a wide variety of NoTs. RFID technology offers security and reliability features that enhance trustworthiness in IoT ecosystems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does U.S. Department of Energy Risk Assessment Methodology provide? (Part 4)

[Assistant]
|            | 34            |    |
| STEP                    |            |               |    |
| 4 REVIEW ANY            |            | 37            |    |
|                         | .
|               |    |
|                         | R4         |               |    |
|                         |            | 41            |    |
|                         |            |               | R4 |

## TABLE OF CONTENTS (Continued)

|      |                                                                    |                                                                                | Page Number                                                                                |    |
|------|--------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|----|
|      | R4 . | Sample Impacts of Threats to and Vulnerabilities of Communications                                       | Sample Impacts of Threats to and Vulnerabilities of Communications                                       | 44 |
|      | R4.5a                                                              | Sample Impacts of Threats to and Vulnerabilities of Computer Hardware                                    | Sample Impacts of Threats to and Vulnerabilities of Computer Hardware                                    | 45 |
|      | R4.5b                                                              | Sample Impacts of Threats to and Vulnerabilities of Computer Software                                    | Sample Impacts of Threats to and Vulnerabilities of Computer Software                                    | 46 |
|      | R4 .

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.2 (NIST 3.6.2)?

[Assistant]
According to Module-Lattice-Based Digital Signature Standard:

3.6.2                                                                  | Public-Key and Signature Length Checks                                 |  12 |
|                                           |                                                            | 3. 3.6.2 Public-Key and Signature Length Checks

Algorithm 3, implementing verification for ML-DSA, and Algorithm 5, implementing verification for HashMLDSA, specify the length of the signature 𝜎 and the public key 𝑝𝑘 in terms of the parameters described in Table 1.

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Bulletin Board System_ User's Guide provide? (Part 5)

[Assistant]
ilable to federal agencies and to the public a wide variety of computer security information and encourages the sharing of information which can help users and managers protect their data and systems.
Information posted on the BBS include an events calendar, software reviews, publications, bibliographies, lists of organizations, and other government bulletin board numbers. This BBS contains no sensitive unclassified or classified information. ## 1.2. Bulletin Board Access and Structure

The Computer Security BBS operates twenty-four hours a day, charges no fee, and is accessible to anyone who has a computer or terminal with either a modem or Internet connection. The BBS requires callers to enter a name and a password, a process called "logging on." All BBS users have equal access to the posted information, and may use the BBS for a maximum of sixty minutes per call and seventy minutes per day. A user who is finished using the BBS disconnects from it, a process called "logging off." The BBS automatically logs off any inactive user, i.e., one who does not press at least one key for a period of three minutes. There will be a warning bell and an on-screen message before automatic log off. If your account is unused after a period of six months, your account is deleted. The bulletin board system contains three subsystems. The bulletin subsystem consists of topic menus with numerous bulletins listed under each topic. Each bulletin contains a limited amount of information, normally consisting of one to three pages. The bulletins can be viewed on the computer screen or can be downloaded (i.e., transferring the entire file to the user's system) for future reference. The file subsystem consists of larger amounts of information that can only be viewed by "downloading." The files are separated into directories that can be viewed prior to selecting files to download.

Computer Security Bulletin Board System_ User's Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines on PDA Forensics provide?

[Assistant]
<!-- image -->

Special Publication 800-72 Sponsored by the Department of Homeland Security

## Guidelines on PDA Forensics

## Recommendations of the National Institute of Standards and Technology

Wayne Jansen Rick  Ayers

NIST Special Publication 800-72

## Guidelines on PDA Forensics

Recommendations of the National Institute of Standards and Technology

Wayne Jansen Rick Ayers

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

November 2004

<!-- image -->

## U.S. Department of Commerce

Donald L. Evans, Secretary

## Technology Administration

Phillip J. Bond, Under Secretary for Technology

National Institute of Standards and Technology

Arden L. Bement, Jr., Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical  analysis  to  advance  the  development  and  productive  use  of  information technology. ITL's  responsibilities  include  the  development  of  technical,  physical, administrative,  and  management  standards  and  guidelines  for  the  cost-effective security  and  privacy  of  sensitive  unclassified  information  in  Federal  computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach  efforts  in  computer  security  and  its  collaborative  activities  with  industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-72 Natl. Inst. Stand. Technol. Spec. Publ.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Information Integrity?

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

| Executive Summary . . . . . . . . . . | Executive Summary . . . . . . . . . . | . . . . . . . . . . . | 1   |
|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1. Introduction . . . . . . . . . | 1. Introduction . . . . . . . . . | . . . . . . . . . . . . . . | 3   |
| 1.1. Document Purpose and Scope                                            | 1.1. Document Purpose and Scope                                                                                | . . . . . . . . . | 7   |
| 1.2. Intended Audience . . | 1.2. Intended Audience . . | . . . . . . . . . . . . . . | 7   |
| 1.3. Organization . . . . | 1.3. Organization . . . . | . . . . . . . . . . . . . . . | 8   |
| Introducing De-Identifcation . | Introducing De-Identifcation . | . . . . . . . . . . . . | 9   |
| 2.1. Historical Context . . | 2.1. Historical Context . . | . . . . . . . . . . . . . . | 9   |
| 2.2. Terminology . . . . | 2.2. Terminology . . . . | . . . . . . . . . . . . . . . . | 12  |
| Governance and Management of Data De-Identifcation . . | Governance and Management of Data De-Identifcation . . | Governance and Management of Data De-Identifcation . . | 18  |
| 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 18  |
| 3.2. | Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Fiscal Year 2022 Cybersecurity and Privacy Annual Report provide?

[Assistant]
<!-- image -->

## 2022 Cybersecurity & Privacy Annual Report

<!-- image -->

## NIST Special Publication

## Fiscal Year 2022 Cybersecurity and Privacy Annual Report

| Patrick O'Reilly, Editor Computer Security Division Information Technology Laboratory        | Co-Editors: Larry Feldman Greg Witte   |
|----------------------------------------------------------------------------------------------|----------------------------------------|
| Kristina Rigopoulos, Editor Applied Cybersecurity Division Information Technology Laboratory | Huntington Ingalls Industries          |

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-225

May 2023

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Gina M. Raimondo, Secretary

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

<!-- image -->

<!-- image -->

## Foreword 5

## Priority Areas

| Cryptography                                | 7   |
|---------------------------------------------|-----|
| Education, Training & Workforce Development | 9   |
| Identity & Access Management                | 11  |
| Privacy                                     | 13  |
| Risk Management & Measurement               | 15  |
| Trustworthy Networks & Platforms            | 17  |
| Usable Cybersecurity                        | 19  |
| NCCoE Summary                               | 21  |
| Opportunities to Engage                     |     |

22

Foreword

<!-- image -->

## FOREWORD

Nelson Mandela famously said, 'Remember to celebrate milestones as you prepare for the road ahead.' This year, we celebrated a major milestone that we're proud of: 50 years of cybersecurity at NIST. Over the last five decades, we have conducted research and developed guidance that has led to extraordinary advancements in cybersecurity.

Fiscal Year 2022 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

3.3.3                                                                                | Validated Cryptography... 3.3.3. 3.3.3 Validated Cryptography

The cryptographic module used by the server shall be a FIPS 140-validated cryptographic module [50, 51].

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Getting Ready for Post-Quantum Cryptography_ Exploring Challenges Associated with Adopting and Using Post-Quantum Cryptographic Algorithms:

While some components of some systems tend to be replaced by improved components on a relatively frequent basis (e.g., cell phones), other components are expected to remain in place for a decade or more (e.g., components in electricity generation and distribution systems). Communications interoperability and records archiving requirements introduce additional constraints on system components. As a general rule, cryptographic algorithms cannot be replaced until all components of a system are prepared to process the replacement. Updates to protocols, schemes, and infrastructures often must be implemented when introducing new cryptographic algorithms. Consequently, algorithm replacement can be extremely disruptive and often takes decades to complete.

Similarly, cybersecurity standards and guidelines and the operational directives and mandates derived from them generally specify or presume the use of public-key cryptography. There is currently no inventory of these that can guide updates to the standards, guidelines, and regulations necessary to accommodate the migration to post-quantum cryptography.

Getting Ready for Post-Quantum Cryptography_ Exploring Challenges Associated with Adopting and Using Post-Quantum Cryptographic Algorithms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

Encryption.....................................................................................................3-4 | | | | | 3.2.3 Data Integrity ................................................................................................3-5 | | | | | 3.2.4 Replay Protection .........................................................................................3-6 | | | | | 3.2.5 Availability.....................................................................................................3-6 | | | | 3.3 | Brief Overview of IEEE 802.11i Security..................................................................3-6 | | | | 3.4 | Summary..................................................................................................................3-9 | | | | Security Framework for Robust Security Networks | .....................................................4-1 | | | | 4.1 | Features of RSNs ....................................................................................................4-1 | | | | 4.2 | Key Hierarchies and Key Distribution and Management .........................................4-3 | | | | | 4.2.1 Pairwise Key Hierarchy ................................................................................4-4 | | | | | 4.2.2 Group Key Hierarchy....................................................................................4-7 | | | | 4.3 | Overview of RSN Data Confidentiality and Integrity Protocols ................................4-7 4.3.1 Temporal Key Integrity Protocol (TKIP)........................................................4-8 | | | | | 4.3.2 Counter Mode with Cipher Block Chaining MAC Protocol (CCMP)............4-10 | | | | 4.4 | Summary................................................................................................................4-14 | | | | Robust | Security Networks Principles of Operation......................................................5-1 | | | | 5.1 | General Principles of IEEE 802.11 Operation..........................................................5-1 | | | | | 5.1.1 IEEE 802.11 Frame Types | ...........................................................................5-1 | | | | 5.1.2 IEEE 802.11 Data Frame Structure..............................................................5-3 | | | | 5.2 | Phases of IEEE 802.11 RSN Operation

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

- Prioritize the patch. A patch may be a higher priority to deploy than others because its deployment would reduce cybersecurity risk more than other patches would. Another patch may be a lower priority because it addresses a low-risk vulnerability on a small number of low-importance assets. - Schedule patch deployment. Many organizations schedule patch deployments as part of their enterprise change management activities. - Acquire the patch. Patches may be downloaded from the internet, built internally by developers or system administrators, or provided through removable media. - Validate the patch. A patch's authenticity and integrity should be confirmed, preferably by automated means, before the patch is tested or installed. The patch could have been acquired from a rogue source or tampered with in transit or after acquisition. - Test the patch. A patch may be tested before deployment. This is intended to reduce operational risk by identifying problems with a patch before placing it into production. Testing may be performed manually or through automated methods. - Distribute the patch. Distributing the patch to the assets that need to have it installed can be organization-controlled (and occur automatically, manually, or as scheduled) or vendor-controlled, such as delivered from the cloud. - Validate the patch. As discussed in Section 2.3.1, a patch's authenticity and integrity should be confirmed before installation, preferably through automated means. - Install the patch. Installation can occur in numerous ways, including automatically; manually when directed to do so by a user, administrator, vendor, or tool; as a result of other software being installed or updated; and through the replacement of removable media used by an asset. Some installations require administrator privileges, such as installing firmware patches for a system basic input/output system (BIOS). 3 Some patch installations require user participation or cooperation.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to A Threat Analysis on UOCAVA Voting Systems:

Finally, there are some difficulties common to absentee voting.  One such difficulty is with signature verification.  Signatures are the most common method for authenticating voters. However, verifying signatures is a difficult task.  In order to verify a signature, a trusted sample signature must be on file with election officials.  Comparing a received signature with a signature on file requires a great deal of training, although automated signature verification applications may make this task easier.

The section documents threats to the transmission options for the Ballot Distribution stage.  This section discusses threats to systems which use postal mail, fax machines, electronic mail, and web sites to distribute blank ballots to registered UOCAVA voters.  The systems analyzed in this section are discussed in Section 4.3.  Note that telephone systems are not considered in this section.  Telephone voting systems provide voters with ballot questions and allow voters to select their votes.  Therefore, telephone voting systems are a type of ballot return system, and are discussed in Section 6.3.2.

authentication occurs in the registration phase, where some type of authenticator (typically a voter signature) is exchanged.  This authenticator must be securely stored by election officials so that it is available to authenticate future correspondence from a voter.  While some authenticators, such as PINs, are easy to verify, training is necessary to verify authenticators like voter signatures.

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements

NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-02-23

## How to Cite this NIST Technical Series Publication

Scarfone KA, Souppaya MP, Fagan MJ (2024) Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines: Developing Cybersecurity and Privacy Concept Mappings. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8477. https://doi.org/10.6028/NIST.IR.8477

## Author ORCID iDs

Karen Scarfone: 0000-0001-6334-9486

Murugiah Souppaya: 0000-0002-8055-8527

Michael Fagan: 0000-0002-1861-2609

## Contact Information

mapping@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8477/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

3.2.1                                                                                | Data Breach and Data Exposure... 3.2.1 Data Breach and Data Exposure

A data breach is an incident that involves sensitive, protected information being copied, transmitted, viewed, deliberately exposed to the public, or used by individuals or entities unauthorized to do so.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Service Mesh Proxy Models for Cloud-Native Applications provide? (Part 5)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

| Executive Summary............................................................................................................................1      | Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 | 1. Introduction...................................................................................................................................2 |
| 2. Typical Service Mesh Data Plane Capabilities and Associated Proxy Functions .................................5                                   | 2. Typical Service Mesh Data Plane Capabilities and Associated Proxy Functions .................................5                                   |
| 3. Proxy Models (Data Plane Architectures) in Service Mesh Implementations ....................................7                                    | 3. Proxy Models (Data Plane Architectures) in Service Mesh Implementations ....................................7                                    |
| 4. Data Plane Architecture Threat Scenarios and Analysis Methodology............................................12                                  | 4.

Service Mesh Proxy Models for Cloud-Native Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters:

Simply deleting e-mails from servers and clients does not typically remove all traces of those e-mails on those systems.  Due to the way that e-mails are typically stored on servers and clients, file-level sanitization software cannot be relied upon to securely erase this data.  These computer systems should be treated as any other containing potentially sensitive data, and sanitizing storage media prior to decommissioning or repurposing.  Section 4.2.4 of NISTIR 7682 provides best practices for decommissioning systems.

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security of Interactive and Automated Access Management Using Secure Shell (SSH):

olate policies, such as leading from development and test systems into production systems, or crossing from a low-impact system to a high-impact system without requiring any additional authentication.
Most importantly, SSH key-based trust relationships can enable an attacker who compromises one system to quickly move (or pivot) from one system to another and spread through an organization-individual trust relationships often collectively form webs of trust across an organization's systems.

Security of Interactive and Automated Access Management Using Secure Shell (SSH)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

| Threats to Public Safety Wearable Devices..................................................
| 42                                                                                |
| 7.4                                                                                | Areas Warranting Further Scrutiny................................................................ | 49                                                                                |
| 8 Security Objectives..............................................................................................53     | 8 Security Objectives..............................................................................................53     |                                                                                |
| 8.1                                                                                | Availability..................................................................................................... | 53                                                                                |
| 8.2                                                                                | Ease of Management.................................................................................... | 54                                                                                |
| 8.3                                                                                | Interoperability ..............................................................................................

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2013 Annual Report:

Evaluation

| Welcome Letter                                                                                | ..................................................................1   |
|----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
| Computer Security Division (CSD) Management Team.......2                                                                                |                                                                       |
| Computer Security Division Organization                                                                                | ..........................3                                           |
| The Computer Security Division Implements the Federal Information Security Management Act                                                          | .................7                                                    |
| Program & Project Achievements for Fiscal Year 2013                                                                                | .....9                                                                |
| NIST Responsibilities Under Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity'                                               | ....................10                                                |
| Contributions to National and International Standards Development...........................................................................11     |                                                                       |
| Identity Management Standards within INCITS B10 and ISO JTC1/SC 17 ................................................................

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Best Practices for Privileged User PIV Authentication:

| NIST SP 800-53 Control Number and Name                             | Applicability to Privileged User Authentication                                                                                |
|--------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
| IA-2, Identification and Authentication (Organizational Users)     | Uniquely identify and authenticate each privileged user. Also, see IA-2 control enhancements (1), (3), (6), (8), (11), and (12). |
| IA-4, Identifier Management                                        | Manage information system identifiers for all privileged users. |
| IA-5, Authenticator Management                                     | Manage information system authenticators for all privileged users. IA-5 control enhancements of particular interest include (1), (2), and (11). |
| IA-8, Identification and Authentication (Non-Organizational Users) | Uniquely identify and authenticate each privileged user. Also, see IA-8 control enhancements (1) and (5). |
| SC-8, Transmission Confidentiality and Integrity                   | Protect the confidentiality and integrity of all communications related to privileged user authentication and privileged sessions. |
| SC-10, Network Disconnect                                          | Terminate network connections from privileged accounts after a defined period of inactivity. |
| SI-2, Flaw Remediation                                             | Apply patches and other updates to correct vulnerabilities in protocols, services, etc. used for privileged user authentication. |
| SI-4, Information System Monitoring                                | Perform ongoing monitoring of all privileged account usage. SI-4 control enhancements of particular interest include (20). |

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc. provide?

[Assistant]
<!-- image -->

## CASE STUDIES IN CYBER SUPPLY CHAIN RISK MANAGEMENT

Observations from Industry

## Palo Alto Networks, Inc. ## INTERVIEWEES:

Jason Ledgerwood - VP Supply Chain Operations and Procurement

Brian Riggs - Sr. Director, Supply Base Management

Jim Sugg - Sr. Product Manager

Shae Trautwein - Supply Chain Risk and Compliance Manager

February 4, 2020

This publication is available free of charge from:

https://doi.org/10.6028/NIST.CSWP.02042020-6

Jon Boyens

Celia Paulsen Computer Security Division

Information Technology Laboratory

Nadya Bartol Kris Winkler James Gimbi

Boston Consulting Group

## SERIES DESCRIPTION

The Case Studies in Cyber Supply Chain Risk Management series engaged with several companies that are mature in managing cyber supply chain risk. These case studies build on the Best Practices in Cyber Supply Chain Risk Management case studies originally published in 2015 with the goals of covering new organizations in new industries and bringing to light any changes in cyber supply chain risk management practices. For information on NIST's Cyber Supply Chain Risk Management project, see https://csrc.nist.gov/projects/cyber-supply-chain-risk-management. ## DISCLAIMER

Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

3.5.4 IT Infrastructure Maintenance Information Type                                                                                | ... 3.5.4 IT Infrastructure Maintenance Information Type

IT infrastructure maintenance involves the planning, design, implementation, and maintenance of an IT Infrastructure to effectively support automated needs (i.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to A Formal Description of the SDNS Security Protocol at Layer 4 (SP4):

3.2.2 Connectionless Network Interface

The use of the connectionless Network service interface for the SP4E Entity poses an additional challenge for the specification.

A Formal Description of the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does De-Identifying Government Datasets_ Techniques and Governance provide? (Part 4)

[Assistant]
h to use de-identification. Before using de-identification, agencies should evaluate their goals for using de-identification and the potential risks that releasing  de-identified  data  might  create.
Agencies  should  decide  upon  a  data-sharing model,  such as publishing de-identified data,  publishing synthetic data based on identified data, providing a query interface that incorporates de-identification, or sharing data in non-public protected enclaves. Agencies can create a Disclosure Review Board to oversee the process of de-identification. They can also adopt a de-identification standard with measurable performance levels and perform re-identification studies to gauge the risk associated with de-identification. Several specific techniques for de-identification are available, including de-identification by removing identifiers, transforming quasi-identifiers, and generating synthetic data using models. People who perform de-identification generally use special-purpose software tools to perform the data manipulation and calculate the likely risk of re-identification. However, not all tools that merely mask personal information provide sufficient functionality for performing de-identification. This document also includes an extensive list of references, a glossary, and a list of specific de-identification tools, which is only included to convey the range of tools currently available and is not intended to imply a recommendation or endorsement by NIST. ## Keywords

data life cycle; de-identification; differential privacy; direct identifiers; Disclosure Review Board; k-anonymity; privacy; pseudonymization; quasi-identifiers; re-identification; synthetic data; The Five Safes. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

The Identify Function is foundational to cybersecurity and the risk management process. Cybersecurity assessments and risk management should start with the Identify Function. Consideration of the organization's mission objectives, business objectives, threat environment, assets, and vulnerabilities will have a significant influence on the overall risk management decision and will impact the other four Functions (i.e., Protect, Detect, Respond, Recover). | Subcategory                                                                                | Applicability to HSNs                                                                                | Informative References                      |
|-----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------|
| ID.BE-1: The organization's role in the supply chain is identified and communicated. | Identify the role in the supply chain and consider any partners' role in the supply chain. Clearly communicate any corresponding expectations and requirements.

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Guide to SSL VPNs:

3.3.2                                                                                | High Availability and Scalability                                                                                | ... 3.3.2 High Availability and Scalability

Two other important features for SSL VPNs are high availability and scalability.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-06-29 Supersedes NIST SP 800-219 (June 2022) https://doi.org/10.6028/NIST.SP.800-219

## How to Cite this NIST Technical Series Publication:

Trapnell M, Trapnell E, Souppaya MP, Gendler B, Brodjieski D, Golbig A, Scarfone K, Heiserman B (2023) Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-219r1. https://doi.org/10.6028/NIST.SP.800-219r1

## Author ORCID iDs

Mark Trapnell: 0000-0002-5266-3610

Eric Trapnell: 0000-0001-9315-3732

Murugiah Souppaya: 0000-0002-8055-8527

Bob Gendler: 0000-0002-8928-6492

Karen Scarfone: 0000-0001-6334-9486

## Contact Information

applesec@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The macOS Security Compliance Project (mSCP) provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way. This publication introduces the mSCP and gives an overview of the resources available from the project's GitHub site, which is continuously curated and updated to support each new release of macOS.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

AES; block cipher; cryptography; mode of operation; SP 800-38; standardization; Triple-DES.

NIST Interagency or Internal Report (NIST IR) 8319 [55] focuses on the Advanced Encryption Standard (AES) [22] that was standardized in FIPS 197 [58]. AES is one of only two block ciphers that are currently standardized by NIST. The other is the Triple Data Encryption Algorithm (TDEA) [10], also known as Triple-DES (Data Encryption Standard). Triple-DES is deprecated and will be disallowed after 2023 [11]. A block cipher can only process inputs of a specific length, known as the block size. AES has a block size of 128 bits, and Triple-DES has a block size of 64 bits. To process inputs of other lengths, it is necessary to use a mode of operation. A mode of operation can process shorter or larger inputs by performing one or more calls to an underlying block cipher. In fact, it is possible to claim that a block cipher is always used in combination with a mode of operation: using a block cipher 'directly' is equivalent to using it in the Electronic Codebook (ECB) mode with the restriction that the input must be exactly one block in length (e.g., 128 bits in the case of AES). Therefore, the real-world applications of the NIST-recommended modes of operation overlap with the applications of the underlying block cipher and include virtually all web browsers, Wi-Fi and cellular devices, and contact and contactless chip cards, as described in NIST IR 8319 [55]. operation. This report analyzes the block cipher modes of operation that are standardized in

Note that NIST SP 800-38G [32], which defines the Format-Preserving Encryption (FPE) modes FF1 and FF3, is currently undergoing a revision that is proposed in Draft NIST SP 80038G, Rev. 1 [33].

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Module-Lattice-Based Digital Signature Standard:

3.4.2. 3.4.2. 3.4.2.

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio provide?

[Assistant]
<!-- image -->

## NIST Special Publication NIST SP 800-221A

## Information and Communications Technology (ICT) Risk Outcomes

Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Stephen Quinn Nahla Ivy Julie Chua Karen Scarfone Matthew Barrett Larry Feldman Daniel Topper Greg Witte

R. K. Gardner

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-221A

<!-- image -->

## NIST Special Publication NIST SP 800-221A

## Information and Communications Technology (ICT) Risk Outcomes

Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

## Stephen Quinn

Applied Cybersecurity Division Information Technology Laboratory

Nahla Ivy

Enterprise Risk Management Office Office of Financial Resource Management

Julie Chua

Office of Information Security

Office of the Chief Information Officer (OCIO) U.S. Department of Health and Human Services

Karen Scarfone Scarfone Cybersecurity

Matthew Barrett CyberESI Consulting Group, Inc. Larry Feldman Daniel Topper Greg Witte Huntington Ingalls Industries

R. K. Gardner New World Technology Partners

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-221A

November 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.

Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.7 (NIST 3.1.7)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.7. 3.1.7.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| 29 | | (AEI) Access to Event Information | ................................................................29 | | (EIM) Event Identification & Monitoring | .........................................................29 | | (EVR) Event Response.................................................................................30 | | | (LCT) Logging Capture & Trigger Support | ....................................................31 | | (RDL) Support of Required Data Logging | .....................................................31 | | (LSR) Audit Log Storage & Retention ...........................................................32 | | | (SRT) Support for Reliable Time...................................................................32 | | | (AUP) Audit Support & Protection .................................................................33 | | | (AWR) State Awareness Support..................................................................34 | | | DS - DEVICE SECURITY .....................................................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 5)

[Assistant]
orkshop and received over 150 position papers, many of which suggested secure software development practices, tasks, examples of implementations, and references for consideration for this SSDF update.
The authors appreciate all of those suggestions, as well as the input from those who spoke at or attended the workshop and shared their thoughts during or after the workshop. Additionally, the authors appreciate the public comments submitted by dozens of organizations and individuals and wish to acknowledge the particularly helpful feedback from Amazon Web Services, Apiiro, Blackberry, BSA | The Software Alliance, the Enterprise Cloud Coalition, the General Services Administration (GSA), Google, IBM, Medical Imaging & Technology Alliance (MITA), Microsoft, Oracle, the Software Assurance Forum for Excellence in Code (SAFECode), Synopsis, the U.S. Navy, Xoomworks, and Robert Grupe. Representatives of Siemens Energy and Synopsis contributed mappings to new references. The authors thank all of their NIST colleagues for their support throughout the SSDF update, especially Curt Barker, Paul Black, Jon Boyens, Jim Foti, Barbara Guttman, Mat Heyman, Nicole Keller, Matt Scholl, Adam Sedgewick, Kevin Stine, and Isabel Van Wyk. The authors also wish to thank all of the individuals and organizations who provided comments on drafts of the original version of the SSDF, including the Administrative Offices of the U.S. Courts, The Aerospace Corporation, BSA | The Software Alliance, Capitis Solutions, the Consortium for Information & Software Quality (CISQ), HackerOne, Honeycomb Secure Systems, iNovex, Ishpi Information Technologies, the Information Security and Privacy Advisory Board (ISPAB), Juniper Networks, Microsoft, MITA, Naval Sea Systems Command (NAVSEA), NIST, Northrop Grumman, the Office of the Undersecretary of Defense for Research and Engineering, Red Hat, SAFECode, and the Software Engineering Institute (SEI).

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities:

If vulnerability characteristics related to these two concepts were measured and documented in a consistent, methodical way, the measurement data could be used by quantitative risk assessment methodologies for determining which vulnerabilities are most important for an organization to address using its limited resources. For example, when planning the security configuration settings for a new system, an organization could use vulnerability measurements as part of determining the relative importance of particular settings and identifying the settings causing the greatest increase in risk. Vulnerability measurement is also useful when evaluating the security of software features, such as identifying the vulnerabilities in those features that should have compensating controls applied to reduce their risk (for example, antivirus software to scan email attachments and awareness training to alter user behavior) and determining which features should be disabled because their risk outweighs the benefit that they provide.

The Exploitation Method metric is not used directly in generating CCSS scores, but the definitions for some of the Exploitability base metrics are dependent on the value of the Exploitation Method metric. The Exploitation Method metric is also useful for planning mitigation strategies, because most Passive configuration issues involve an error or policy violation that can be fixed quickly. Active configuration issues have a much wider range of mitigation possibilities and often require significantly more analysis and planning for mitigation than Passive configuration issues.

The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.6 (NIST 3.3.6)?

[Assistant]
According to Guide to SSL VPNs:

3.3.6                                                                                | Access Control ... 3.3.6 Access Control

SSL VPN products vary greatly in their access control features.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Computer Security_ Selected Articles:

This National Institute of Standards and Technology Internal Report (NISTIR) presents nine articles which represent a wide spectrum of computer security information. The articles were selected by the staff of the Computer Security Division, Computer Systems Laboratory, at the National Institute of Standards and Technology. The information provided is by no means comprehensive; rather the articles offer a quick reference or an introduction to a specific security technology. The article "Is your System Safe?" is a high-level overview of the Internet worm and addresses ways to correct various system vulnerabilities. The article "Computer Viruses and Personal Computers" provides guidance on preventing and handling computer viruses. The remaining articles discuss software copying, local-area-network security, computer ethics, data security responsibilities, risk analysis, and encryption. This publication will benefit computer security managers as well as managers and users of information technology.

The second part of this document contains a reading list prepared by the Information Exchange Working Group of the Computer and Telecommunications Security Council, a govemment/industry technical group that was sponsored by NIST from 1987 to 1990. The list provides titles, sources, and abstracts of important computer security publications that were relevant to the council's interests.

What's the solution when you have a legitimate need for dial out 7 Start by using a communications server. A communications server is a separate machine on the LAN that allows network users to connect to the outside wono througn one modem. To make this more attractive, you might consider a combination facsimile and modem board: you have the advantage of making both dial out and fax available to all network users.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for Derived Personal Identity Verification (PIV) Credentials:

-  X.509 Certificate for Digital SignatureThe read access control rule for the X.509 Certificate for Digital Signature and the PKI cryptographic function access rule for the corresponding private key are as described in Section 3.2.1 of [SP800-73Part1] .
-  X.509 Certificate for Key ManagementThe read access control rule for the X.509 Certificate for Key Management and the PKI cryptographic function access rule for the corresponding private key are as described in Section 3.2.2 of [SP800-73Part1] .
-  Discovery ObjectThe requirements for the Discovery Object are as described in Section 3.3.2 of [SP800-73Part1]  except for the following:
- o References to 'PIV Card Application AID' are replaced by 'Derived PIV Application AID.'
- o References to 'PIV Card Application PIN' are replaced by 'Derived PIV Application

Guidelines for Derived Personal Identity Verification (PIV) Credentials


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

| 1 | Introduction ............................................................................................................1 | Introduction ............................................................................................................1 | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 2 | Hardware Platform Security Overview .................................................................3 | Hardware Platform Security Overview .................................................................3 | | 3 | Platform Integrity Verification...............................................................................5 | Platform Integrity Verification...............................................................................5 | | | 3.1 Hardware Security Module (HSM) | ..................................................................

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4):

3.3.2.

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

AHLC-SR-2 : Host path volumes should not be used, because they create tight coupling between the container and the node on which it is hosted, constraining the migration and flexible resource scheduling process. | TAG        | RECOMMENDATION TEXT                                                                                | FRAMEWORK AREA                                                  |
|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------|
| ISMC-SR-1  | If certificate-based authentication is used for authenticating service calls, the signing certificate used by the service mesh's CA module should be rooted in the organization's existing PKI to allow for auditability, rotation, and revocation. | Initial Service Mesh Configuration                              |
| ISMC-SR-2  | Communication between the service mesh control plane and the application orchestration and resource management platform's configuration server must be authenticated and authorized. | Initial Service Mesh Configuration                              |
| A HLC-SR-1 | Containers and applications should not be run as root (thus becoming privileged containers). In Kubernetes, the configuration setting for this is to set the value TRUE for 'MustRunAsNonRoot' flag.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Application Container Security Guide:

3.2.1 レジストリへのセキュアでない接続 ... 3.2.1 レジストリへのセキュアでない接続

イメージには組織独自のソフトウェアや埋め込まれた秘密情報など、機微なコンポーネントが含まれていることがよ くある。レジストリへの接続が、セキュアでないチャネルで行われた場合、イメージの内容は、平文で送信される他 のデータと同様の機密性に対するリスクにさらされる。また、レジストリを対象としているネットワークトラフィッ クを傍受し、そのトラフィック内の開発者や管理者の認証情報を盗み出し、詐欺的なイメージや古いイメージをオー ケストレータに提供したりする中間者攻撃のリスクも高まる。

## 3.